Administrator-forced redirect deletion via missing CSRF checks

CSRF in the easy-broken-link-checker plugin through 9.0.2 allows remote attackers to delete redirect records through an administrator's browser. The URL-shortener bulk-action handler accepts a forged POST to admin.php with attacker-chosen id[] and delete actions without validating a CSRF nonce. Exploitation requires a logged-in administrator to open attacker-controlled HTML, and the demonstrated action deletes a selected redirection URL.